Changed OAuth token+secret encryption to use supplemental user key from NSS DB.

BUG=chromium-os:18633
TEST=none
Review URL: http://codereview.chromium.org/7756025

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@99912 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 72 insertions, 0 deletions

diff --git a/crypto/nss_util.cc b/crypto/nss_util.cc
index aa41ba2..9020e7e 100644
--- a/crypto/nss_util.cc
+++ b/crypto/nss_util.cc
@@ -31,6 +31,10 @@
 #include "base/threading/thread_restrictions.h"
 #include "crypto/scoped_nss_types.h"
 
+#if defined(OS_CHROMEOS)
+#include "crypto/symmetric_key.h"
+#endif
+
 // USE_NSS means we use NSS for everything crypto-related.  If USE_NSS is not
 // defined, such as on Mac and Windows, we use NSS for SSL only -- we don't
 // use NSS for crypto or certificate verification, and we don't use the NSS
@@ -83,6 +87,15 @@ FilePath GetDefaultConfigDirectory() {
   return dir;
 }
 
+#if defined(OS_CHROMEOS)
+// Supplemental user key id.
+unsigned char kSupplementalUserKeyId[] = {
+  0xCC, 0x13, 0x19, 0xDE, 0x75, 0x5E, 0xFE, 0xFA,
+  0x5E, 0x71, 0xD4, 0xA6, 0xFB, 0x00, 0x00, 0xCC
+};
+#endif  // defined(OS_CHROMEOS)
+
+
 // On non-chromeos platforms, return the default config directory.
 // On chromeos, return a read-only directory with fake root CA certs for testing
 // (which will not exist on non-testing images).  These root CA certs are used
@@ -288,6 +301,40 @@ class NSSInitSingleton {
     return FindSlotWithTokenName(token_name);
   }
 
+  SymmetricKey* GetSupplementalUserKey() {
+    DCHECK(chromeos_user_logged_in_);
+
+    PK11SlotInfo* slot = NULL;
+    PK11SymKey* key = NULL;
+    SECItem keyID;
+    CK_MECHANISM_TYPE type = CKM_AES_ECB;
+
+    slot = GetPublicNSSKeySlot();
+    if (!slot)
+      goto done;
+
+    if (PK11_Authenticate(slot, PR_TRUE, NULL) != SECSuccess)
+      goto done;
+
+    keyID.type = siBuffer;
+    keyID.data = kSupplementalUserKeyId;
+    keyID.len = static_cast<int>(sizeof(kSupplementalUserKeyId));
+
+    // Find/generate AES key.
+    key = PK11_FindFixedKey(slot, type, &keyID, NULL);
+    if (!key) {
+      const int kKeySizeInBytes = 32;
+      key = PK11_TokenKeyGen(slot, type, NULL,
+                             kKeySizeInBytes,
+                             &keyID, PR_TRUE, NULL);
+    }
+
+  done:
+    if (slot)
+      PK11_FreeSlot(slot);
+
+    return key ? SymmetricKey::CreateFromKey(key) : NULL;
+  }
 #endif  // defined(OS_CHROMEOS)
 
 
@@ -702,6 +749,9 @@ bool EnsureTPMTokenReady() {
   return g_nss_singleton.Get().EnsureTPMTokenReady();
 }
 
+SymmetricKey* GetSupplementalUserKey() {
+  return g_nss_singleton.Get().GetSupplementalUserKey();
+}
 #endif  // defined(OS_CHROMEOS)
 
 // TODO(port): Implement this more simply.  We can convert by subtracting an
diff --git a/crypto/nss_util.h b/crypto/nss_util.h
index 2a2e8a5..b87b4a0 100644
--- a/crypto/nss_util.h
+++ b/crypto/nss_util.h
@@ -24,6 +24,8 @@ class Time;
 // initialization functions.
 namespace crypto {
 
+class SymmetricKey;
+
 #if defined(USE_NSS)
 // EarlySetupForNSSInit performs lightweight setup which must occur before the
 // process goes multithreaded. This does not initialise NSS. For test, see
@@ -133,6 +135,14 @@ CRYPTO_EXPORT bool IsTPMTokenReady();
 // Same as IsTPMTokenReady() except this attempts to initialize the token
 // if necessary.
 CRYPTO_EXPORT bool EnsureTPMTokenReady();
+
+// Gets supplemental user key. Creates one in NSS database if it does not exist.
+// The supplemental user key is used for AES encryption of user data that is
+// stored and protected by cryptohome. This additional layer of encryption of
+// provided to ensure that sensitive data wouldn't be exposed in plain text in
+// case when an attacker would somehow gain access to all content within
+// cryptohome.
+CRYPTO_EXPORT SymmetricKey* GetSupplementalUserKey();
 #endif
 
 // Convert a NSS PRTime value into a base::Time object.
diff --git a/crypto/symmetric_key.h b/crypto/symmetric_key.h
index 5bb92b7..500324e 100644
--- a/crypto/symmetric_key.h
+++ b/crypto/symmetric_key.h
@@ -71,6 +71,11 @@ class CRYPTO_EXPORT SymmetricKey {
   // carefully.
   bool GetRawKey(std::string* raw_key);
 
+#if defined(OS_CHROMEOS)
+  // Creates symmetric key from NSS key. Takes over the ownership of |key|.
+  static SymmetricKey* CreateFromKey(PK11SymKey* key);
+#endif
+
  private:
 #if defined(USE_OPENSSL)
   SymmetricKey() {}
diff --git a/crypto/symmetric_key_nss.cc b/crypto/symmetric_key_nss.cc
index 9690265..546c457 100644
--- a/crypto/symmetric_key_nss.cc
+++ b/crypto/symmetric_key_nss.cc
@@ -120,6 +120,13 @@ bool SymmetricKey::GetRawKey(std::string* raw_key) {
   return true;
 }
 
+#if defined(OS_CHROMEOS)
+// static
+SymmetricKey* SymmetricKey::CreateFromKey(PK11SymKey* key) {
+  return new SymmetricKey(key);
+}
+#endif
+
 SymmetricKey::SymmetricKey(PK11SymKey* key) : key_(key) {
   DCHECK(key);
 }